2026 Actual Amazon SOA-C03 Dumps, Updated Exam Questions for Guaranteed Pass

SOA-C03 free sample questions and answers

Amazon SOA-C03 practice quiz with correct answers for search indexing.

1. Question 1

   A company observes a dramatic increase in 500 status code responses from an HTTP application that runs on Amazon EC2 instances. The EC2 instances are in an Auto Scaling group and use EC2 health checks for resiliency. The company uses Amazon CloudWatch to collect logs for the EC2 instances and the HTTP server logs.

   A CloudOps engineer investigates the cause of the status codes. The CloudOps engineer finds that errors correlate with times when the Auto Scaling group was either replacing EC2 instances or performing scale-in actions. The CloudOps engineer needs to improve the resiliency of the application's architecture.

   Which solution will meet this requirement?

   AReconfigure the Auto Scaling group to increase the default cooldown configuration.
   

   BReconfigure the EC2 instance health checks to use Elastic Load Balancing (ELB) health checks.
   

   CReconfigure the Auto Scaling group to increase the minimum capacity configuration.
   

   DReconfigure the EC2 instance health checks to increase the health check grace period.
   

   Correct answer: B

   The errors occur during Auto Scaling replacement and scale-in events, which strongly indicates that instances are being terminated or recycled while they are still serving traffic. When an Auto Scaling group uses only EC2 status checks, the health evaluation is limited to instance-level signals (such as system reachability and instance reachability). Those checks do not validate whether the application process is healthy, whether the web server is still responding correctly, or whether the instance is safely able to continue serving requests while shutdown activities are underway. As a result, traffic can continue to reach an instance that is about to be terminated, or a newly launched instance can be marked healthy at the EC2 layer before the application is actually ready, producing spikes in 5xx responses.

   Using Elastic Load Balancing health checks integrates the Auto Scaling group with the load balancer's application-aware health evaluation. The load balancer can perform health checks against a specific endpoint (for example, /health) over HTTP/HTTPS and determine whether the application is responding successfully. Auto Scaling can then replace instances based on real service health rather than only infrastructure health. This approach improves resiliency because unhealthy or draining instances are removed from load balancing before they cause user-facing errors, and newly launched instances are kept out of rotation until they pass the ELB health checks.

   Increasing cooldown (A) only slows scaling actions and does not ensure safe traffic draining. Increasing minimum capacity (C) can reduce impact but does not address the root cause of instances receiving traffic during lifecycle changes. Increasing grace period (D) helps initial warm-up, but it does not reliably protect users during scale-in and termination without application-level health integration. Therefore, ELB health checks are the best solution.

   ==

   
   

2. Question 2

   A company is running an application on premises and wants to use AWS for data backup. All of the data must be available locally. The backup application can write only to block-based storage that is compatible with the Portable Operating System Interface (POSIX).

   Which backup solution will meet these requirements?

   AConfigure the backup software to use Amazon S3 as the target for the data backups.
   

   BConfigure the backup software to use Amazon S3 Glacier Flexible Retrieval as the target for the data backups.
   

   CUse AWS Storage Gateway, and configure it to use gateway-cached volumes.
   

   DUse AWS Storage Gateway, and configure it to use gateway-stored volumes.
   

   Correct answer: D

   The Storage Gateway service enables hybrid cloud backup by presenting local block storage that synchronizes with AWS cloud storage. For scenarios where all data must remain available locally while still backed up to AWS, the correct mode is gateway-stored volumes.

   AWS documentation defines:

   ''Use stored volumes if you want to keep all your data locally while asynchronously backing up point-in-time snapshots to Amazon S3 for durable storage.''

   These volumes expose an iSCSI interface compatible with POSIX file systems, allowing direct use by on-premises backup software.

   Gateway-cached volumes (Option C) store primary data in AWS with limited local cache, violating the ''all data must be available locally'' requirement. Options A and B are object-based storage solutions, not compatible with POSIX or block-based backup applications.

   Therefore, Option D fully satisfies CloudOps reliability and continuity best practices by ensuring local availability, cloud durability, and POSIX compatibility for backups.

   
   

3. Question 3

   A company's AWS accounts are in an organization in AWS Organizations. The organization has all features enabled. The accounts use Amazon EC2 instances to host applications. The company manages the EC2 instances manually by using the AWS Management Console. The company applies updates to the EC2 instances by using an SSH connection to each EC2 instance.

   The company needs a solution that uses AWS Systems Manager to manage all the organization's current and future EC2 instances. The latest version of Systems Manager Agent (SSM Agent) is running on the EC2 instances.

   Which solution will meet these requirements?

   AConfigure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Deploy the Systems Manager Default Host Management Configuration Quick Setup from the management account.
   

   BConfigure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Create a Systems Manager Run Command that attaches the AmazonSSMServiceRolePolicy IAM policy to every IAM role that the EC2 instances use. Invoke the command in every account in the organization.
   

   CCreate an AWS CloudFormation stack set that contains a Systems Manager parameter to define the Default Host Management Configuration role. Use the organization's management account to deploy the stack set to every account in the organization.
   

   DCreate an AWS CloudFormation stack set that contains an EC2 instance profile with the AmazonSSMManagedEC2InstanceDefaultPolicy IAM policy attached. Use the organization's management account to deploy the stack set to every account in the organization.
   

   Correct answer: A

   AWS CloudOps automation best practices recommend using AWS Systems Manager Quick Setup for organization-wide management and configuration of EC2 instances. The Default Host Management Configuration Quick Setup automatically enables Systems Manager capabilities such as Patch Manager, Inventory, Session Manager, and Automation across all managed instances within the organization.

   When deployed from the management account, Quick Setup automatically integrates with AWS Organizations to propagate configuration and permissions to existing and future accounts. This meets the requirement for organization-wide management with no manual configuration or SSH access. AWS documentation notes:

   ''You can use Quick Setup in the management account of an organization in AWS Organizations to configure Systems Manager capabilities for all accounts and Regions. Quick Setup automatically keeps configurations up to date.''

   Options B, C, and D require custom deployments or manual IAM updates, lacking centralized automation. Therefore, Option A fully satisfies CloudOps standards for automated provisioning and ongoing management of EC2 instances across an organization.

   
   

4. Question 4

   A company has deployed Amazon EC2 instances from custom Amazon Machine Images (AMIs) in two AWS Regions. The company registered all the instances with AWS Systems Manager.

   The company discovers that the operating system on some instances has a significant zero-day exploit. However, the company does not know how many instances are affected.

   A CloudOps engineer must implement a solution to deploy operating system patches for the affected EC2 instances.

   Which solution will meet this requirement with the LEAST operational overhead?

   ADefine a patch baseline in Systems Manager Patch Manager. Use a Patch Manager scan to identify the affected instances. Use the Patch Now option in each Region to update the affected instances.
   

   BUse AWS Config to identify the affected instances. Define a patch baseline in Systems Manager Patch Manager. Use the Patch Now option in Patch Manager to update the affected instances.
   

   CCreate an Amazon EventBridge rule to react to Systems Manager Compliance events. Configure the EventBridge rule to run a patch baseline on the affected instances.
   

   DUse AWS Config to identify the affected instances. Update the existing EC2 AMIs with the desired patch. Manually launch instances from the new AMIs to replace the affected instances in both Regions.
   

   Correct answer: A

   Because all instances are already managed by AWS Systems Manager, the lowest-overhead approach is to use Systems Manager Patch Manager end-to-end. Patch Manager is built specifically to scan managed instances for missing patches and to apply operating system patches according to defined rules. By defining a patch baseline, the CloudOps engineer establishes which patches are approved (and how quickly critical patches are approved), plus any exclusions and compliance rules. A Patch Manager scan can then be run to determine which instances are noncompliant and therefore likely affected by the vulnerability, without the engineer needing to manually inventory hosts.

   After identifying affected (noncompliant) instances through the scan results, Patch Manager can apply patches directly using Patch Now (or an equivalent on-demand patch operation) in each Region. This matches the multi-Region requirement while keeping operations simple: no custom code, no additional services, and no complex event orchestration. It also produces compliance visibility in Systems Manager, which helps track remediation status for incident response.

   Option B adds AWS Config unnecessarily. AWS Config is useful for recording and evaluating configuration changes and can report compliance against configuration rules, but it is not the most direct tool for identifying missing OS patches on instances already under Systems Manager management. Option C introduces additional moving parts (EventBridge rules and event-driven automation). While it can be powerful, it is more complex than a straightforward Patch Manager scan-and-patch workflow, and it assumes the right compliance events exist for this scenario before remediation begins. Option D is the highest operational burden because it requires rebuilding AMIs, launching replacement instances, and coordinating replacements across two Regions. That approach aligns to immutable infrastructure patterns, but it is not the least overhead for rapid remediation of existing instances.

   Therefore, using Patch Manager with a patch baseline, scanning to identify affected instances, and applying patches in each Region is the simplest and most operationally efficient solution.

   ==

   
   

5. Question 5

   A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs to send specific events from all the accounts in the organization to a new receiver account, where an AWS Lambda function will process the events.

   A CloudOps engineer configures Amazon EventBridge to route events to a target event bus in the us-west-2 Region in the receiver account. The CloudOps engineer creates rules in both the sender and receiver accounts that match the specified events. The rules do not specify an account parameter in the event pattern. IAM roles are created in the sender accounts to allow PutEvents actions on the target event bus.

   However, the first test events from the us-east-1 Region are not processed by the Lambda function in the receiving account.

   What is the likely reason the events are not processed?

   AInterface VPC endpoints for EventBridge are required in the sender accounts and receiver accounts.
   

   BThe target Lambda function is in a different AWS Region, which is not supported by EventBridge.
   

   CThe resource-based policy on the target event bus must be modified to allow PutEvents API calls from the sender accounts.
   

   DThe rule in the receiving account must specify {'account': ['sender-account-id']} in its event pattern and must include the receiving account ID.
   

   Correct answer: C

   Per the AWS Cloud Operations and EventBridge documentation, when events are sent across AWS accounts --- particularly from multiple accounts in an AWS Organization --- the target event bus in the receiver account must include a resource-based policy that explicitly allows events:PutEvents API calls from the sender accounts or the organization ID.

   Even if the sender accounts have IAM permissions to call PutEvents, the receiving event bus must trust those accounts via a resource policy. Without this configuration, EventBridge automatically rejects incoming cross-account events, and those events never reach the target Lambda function for processing.

   AWS guidance states that ''Cross-account event delivery requires a resource-based policy on the event bus that grants permissions to the source accounts or organization.'' The policy can include either individual AWS account IDs or the organization's root ID.

   In this scenario, because the events originate from multiple accounts and there is no resource policy on the target event bus to authorize those sender accounts, the events are not delivered.

   Therefore, the correct cause is C -- the resource-based policy on the target event bus must be modified to allow PutEvents API calls from the sender accounts.